[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Platform Firmware Resiliency Guidelines:

Platform and device manufacturers need to determine what level of event logging might be required for their systems, taking into account the intended users' environments for those systems.  Events which are logged should be recorded in a manner which provides assurances of their integrity and allows for the secure recovery and transmission of logged events.  Care must be taken to ensure event log access is controlled.  Unauthorized personnel can use event log data analysis to broaden the attack surface.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective:

machine-readable vulnerability identification and metrics, platform and asset identification, actionable threat information and policy triggers for actions to respond to threats and policy violations.
Automated activities would include a Security Operation Center (SOC) to ensure autonomous and continuing monitoring and evolution of the security state of assets based upon prescribed events.

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Password-Based Key Derivation_ Part 1_ Storage Applications:

| Approved                 | FIPS-approved and/or NIST-recommended. An algorithm or technique that is 1) specified in a FIPS or NIST Recommendation; or 2) adopted in a FIPS or NIST Recommendation; or 3) specified in a list of NIST-approved security functions. |
|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Authenticated encryption | A function in which plaintext is encrypted into ciphertext, and a MACis generated on the plaintext or ciphertext and, optionally, on associated data that is not encrypted. |
| Cryptographic algorithm  | A well-defined computational procedure that takes variable inputs that may include a cryptographic key to provide confidentiality, data integrity, authentication and/or non-repudiation. |
| Cryptographic key (key)  | A binary string that is used as a parameter by a cryptographic algorithm. |
| Data protection key      | A key or a set of keys used to protect or recover data, verify the authenticity or integrity of the protected data or to protect the private key used to generate digital signatures. |
| Decryption               | The process of transforming ciphertext into plaintext using a cryptographic algorithm and key. |
| Digest size              | The output length of a hash function. |
| Encryption               | The process of transforming plaintext into ciphertext using a cryptographic algorithm and key. |
| Entropy                  | A measure of the amount of uncertainty in an unknown value. |
| Iteration count          | The number of times that the pseudorandom function is called to generate a block of keying material . |
| Key                      | See cryptographic key. |

Recommendation for Password-Based Key Derivation_ Part 1_ Storage Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Stateful Hash-Based Signature Schemes:

An application that may fit this profile is the authentication of firmware updates for constrained devices. Some constrained devices that will be deployed in the near future will be in use for decades. These devices will need to have a secure mechanism for receiving firmware updates, and it may not be practical to change the code for verifying signatures on updates once the devices have been deployed. | [8]   | McGrew D, Kampanakis P, Fluhrer S, Gazdag S, Butin D, Buchmann J (2016) State Management for Hash-Based Signatures. Cryptology ePrint Archive , Report 2016/357. https://eprint.iacr.org/2016/357.pdf                                                                                |
|-------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [9]   | Genêt A, Kannwischer MJ, Pelletier H, McLauchlan A (2018) Practical Fault Injection Attacks on SPHINCS. Cryptology ePrint Archive , Report 2018/674. https://eprint.iacr.org/2018/674                                                                                |
| [10]  | Castelnovi L, Martinelli A, Prest T (2018) Grafting trees: A fault attack against the SPHINCS framework. Post-Quantum Cryptography - 9th International Conference (PQCrypto 2018) , Lecture Notes in Computer Science 10786, pp 165-184. https://doi.org/10.1007/978-3-319-79063-3_8 |
| [11]  | Fluhrer S (2017) Further Analysis of a Proposed Hash-Based Signature Standard . Cryptology ePrint Archive , Report 2017/553. https://eprint.iacr.org/2017/553.pdf                                                                                |
| [12]  | Buchmann J, Dahmen E, Hulsing A (2011) XMSS - A Practical Forward Secure Signature Scheme based on Minimal Security Assumptions .

Recommendation for Stateful Hash-Based Signature Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Guide to Information Technology Security Services:

3.4.2 Prepare and Review Systems Security Requirements

The Contractor shall prepare a list of system security requirements.

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Foundations of a Security Policy for Use of the National Research and Educational Network:

Policy | 11 | | 2.5 | Projected View of the NREN | Projected View of the NREN | 11 | | | 2.5.1 | Long-Range View | 11 | | | 2.5.2 | Fundamental Characteristics | 12 | | | 2.5.3 | Constituency | 13 | | | 2.5.4 | Network Topology and Security Considerations | 14 | | | Conclusion | Conclusion | 15 | | 2.6 2.7 | References | References | 16 | | 3.1 | for a National Network Security Policy Introduction | for a National Network Security Policy Introduction | 18 | | 3.2 | Computer Information Security and Security Policies | Computer Information Security and Security Policies | 18 | | | 3.2.1 | Concept of Computer Information Security | 18 | | | 3.2.2 Specification of a Security Policy | 3.2.2 Specification of a Security Policy | 19 | | 3.3 | Ethical and Legal Considerations | Ethical and Legal Considerations | 19 | | 3.4 | Need for a National Network Security Policy | Need for a National Network Security Policy | 20 | | 3.5 | Examples of Existing Organizational Policies | Examples of Existing Organizational Policies | 22 |

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of :

's records without the consent of the student (or the parent of a minor student) except for certain specified purposes, or pursuant to a court order or lawfully issued subpoena. 20 U.S.C. § 1232g. 22.
Some States also have enacted statutes which place limitations on the ability of schools to disclose information from school records to third parties. See . e . q . Del. Code tit. 14, § 4111; Idaho Code § 9-203(6); Ky. Rev. Stat. § 421.216; Mich. Comp. Laws § 600.2165; N.C. Gen. Stat. § 8-53-4. 23. The NAIC Model Law (approved by the NAIC in December 1979 and enacted in 13 States since then) requires insurance companies and insurance agents to notify applicants about the collection and disclosure of personal data, and to specify when information is requested solely for marketing or research purposes. In addition, the Model Law restricts the use of "pretext interviews" (in which the identity or purpose of the interviewer is misrepresented) and requires specific consent forms to be used for the collection of information that requires authorization from an individual. A specific notice must also be given if information is collected via personal interviews with neighbors, acquaintances, or associates of an individual. See . e . q . Calif. Ins. Code § 791.

Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs:

trustworthiness and guaranteed veracity of information. The possible values for this metric are: None (N), Partial (P), and Complete (C). Increased integrity impact increases the vulnerability score.
| Metric                                                                                | Evaluation                                             | Score                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact --------------------------------------------------------------------------------------------------------------------- | [Local] [High] [None] [Complete] [Complete] [Complete] | --------------------------------------------------------------------------------------------------------------------- (0.395) (0.35) (0.704) (0.66) (0.66) (0.66) |

Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

| Function Unique Identifier | Function | Category Unique Identifier | Category | |------------------------------|------------|------------------------------|-------------------------------------------------| | ID | Identify | ID.AM | Asset Management | | ID | Identify | ID.BE | Business Environment | | ID | Identify | ID.GV | Governance | | ID | Identify | ID.RA | Risk Assessment | | ID | Identify | ID.RM | Risk Management Strategy | | PR | Protect | PR.AC | Access Control | | PR | Protect | PR.AT | Awareness and Training | | PR | Protect | PR.DS | Data Security | | PR | Protect | PR.IP | Information Protection Processes and Procedures | | PR | Protect | PR.MA | Maintenance | | PR | Protect | PR.PT | Protective Technology | | DE | Detect | DE.AE | Anomalies and Events | | DE | Detect | DE.CM | Security Continuous Monitoring | | DE | Detect | DE.DP | Detection Processes | | RS | Respond | RS.RP | Response Planning | | RS | Respond | RS.CO | Communications | | RS | Respond | RS.AN | Analysis | | RS | Respond | RS.MI | Mitigation | | RS | Respond

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Information Integrity?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| ASSESSMENT PROCEDURES................................................................................................................
| 3   |
| 2.2                                                                                | ASSURANCE CASES.............................................................................................................................. | 4   |
| CHAPTER THREE THE PROCEDURES............................................................................................... | CHAPTER THREE THE PROCEDURES............................................................................................... | 7   |
| 3.1                                                                                | ACCESSCONTROL ............................................................................................................................... | 8   |
| 3.2                                                                                | AWARENESSANDTRAINING............................................................................................................... | 9   |
| 3.3                                                                                | AUDIT ANDACCOUNTABILITY........................................................................................................... | 10  |
| 3.4                                                                                | CONFIGURATION MANAGEMENT.....................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

| Attack Step Name            | Attack Step Purpose (General)                                                                                | Capability-Specific Examples                                                                                |
|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1) Gain Internal Entry      | The attacker is outside the target boundaries and seeks entry. Examples include: spear phishing email sent; distributed denial of service (DDoS) attack against .gov initiated; unauthorized person attempts to gain physical access to restricted facility. | Block Local Access: Prevent or minimize compromised, vulnerable, or targeted software from entering or being stored on the network or devices in a way that would allow installation or execution. |
| 3) Gain Foothold            | The attacker has gained entry to the assessment object and achieves enough compromise to gain a foothold, but without persistence.

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines for the Use of PIV Credentials in Facility Access:

credential; e-authentication; identity credential; issuance; personal identity verification (PIV); physical access control system (PACS); PIV authentication mechanisms; PIV cards; public key infrastructure (PKI); validation

This document is intended for government officials responsible for implementing Homeland Security Presidential Directive-12 (HSPD-12) compliant physical access control systems (PACS). Information in this document is also useful to government contractors and physical security vendors that provide HSPD-12 systems, products, and integration services. It is expected that readers have a general knowledge of PIV standards, including [FIPS 201-2], [SP800-73], and [SP800-78].

Many changes in this document were made to align SP 800-116 with revision 2 of FIPS 201 (FIPS 201-2). For example, credential validation is now required (see Section 4.4). The CHUID authentication mechanism has been deprecated due to security concerns. For this reason, this publication marks the authentication mechanism as deprecated to signify that it is not a viable authentication mechanism to deploy for physical access control system (PACS). The CHUID data element on the PIV Card, however, remains a mandatory element as the BIO(-A) and SYMCAK authentication mechanisms use the data element as a source for the card's expiration date. It also provides unique identifiers for PACS ACLs. The previous version of this document also included the combined VIS + CHUID authentication mechanism as an option to transitioning from Unrestricted to Controlled areas. VIS + CHUID, however, is not included in this version of the document since it provides 'LITTLE or NO' confidence in the identity of the cardholder.

Guidelines for the Use of PIV Credentials in Facility Access


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Guide to Information Technology Security Services:

3.4.3 Perform Security Test and Evaluation 16 of System

The Contractor shall perform a security test and evaluation to demonstrate through appropriate verification techniques, verification procedures, and procedure refinements, that the management, operational, and technical security controls for the IT system are implemented correctly and are effective in their application.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

This includes requirements from internal sources (e.g., the organization's policies, business objectives, and risk management strategy) and external sources (e.g., applicable laws and regulations). | PO.1.1 : Identify and document all security requirements for the organization's software development infrastructures and processes, and maintain the requirements over time. | Example 1 : Define policies for securing software development infrastructures and their components, including development endpoints, throughout the SDLC and maintaining that security. Example 2 : Define policies for securing software development processes throughout the SDLC and maintaining that security, including for open-source and other third-party software components utilized by software being developed. Example 3 : Review and update security requirements at least annually, or sooner if there are new requirements from internal or external sources, or a major security incident targeting software development infrastructure has occurred. Example 4 : Educate affected individuals on impending changes to requirements.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Considerations for Remote Electronic UOCAVA Voting provide? (Part 5)

[Assistant]
|
| 5 INTEGRITY................................................................................ 23   | 5 INTEGRITY................................................................................
23   | 5 INTEGRITY................................................................................ 23   |
| 5.1                                                                                | POTENTIAL BENEFITS                                                                               | ....................................................................23                           |
| 5.2                                                                                | PROPERTIES ..............................................................................23      |                                                                                |
| 5.3                                                                                | THREATS TO INTEGRITY .................................................................27         |                                                                                |
| 5.4                                                                                | CURRENT AND EMERGING TECHNICAL APPROACHES.................................30                     |                                                                                |
| 5.5                                                                                | OPEN I SSUES.............................................................................37      |                                                                                |
| 6 AVAILABILITY........................................................................... 38     | 6 AVAILABILITY...........................................................................

Security Considerations for Remote Electronic UOCAVA Voting

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Best Practices for Privileged User PIV Authentication:

Homeland Security Presidential Directive 12 (HSPD-12) [4] mandated the development and use of a federal standard for identification and authentication of federal employees and contractors. HSPD-12's intent is to eliminate the 'wide variations in the quality and security of identification used to gain access.' The standard resulting from HSPD-12, Personal Identity Verification (PIV), is defined in Federal Information Processing Standards (FIPS) Publication 201 [5]. FIPS

This work resulted in the development of the CSIP [1]. A major gap identified by the CSIP is the delay in utilizing PIV credentials for logical access control and identity management on federal information systems, with an especially high priority for strengthening authentication for

The NIST Risk Management Framework (RMF) [12] specifies the security risk management activities that an agency should perform throughout the system development lifecycle. The RMF references the associated standards and guidelines necessary to categorize system risk, select and implement security controls, and assess, monitor, and enhance their efficacy over time.

Best Practices for Privileged User PIV Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

Inventory scanning can also be applied to collect information on the presence of software artifacts on systems, such as malware or characteristics of malware that indicate its presence. SCAP content authored for this purpose can be used to detect classes or categories of malware based on system state that may be common across multiple malware instances. For example, it is a common practice to reuse malware code, making modifications to address available detection methods, change propagation characteristics, etc. It is also possible to author content that detects a specific instantiation of malware. For example, hashing of files can be used to identify a malicious executable or library.

- An OVAL inventory definition. This definition SHALL be contained in an OVAL component, which holds definitions of technical procedures for determining whether or not a specific target asset has software (product, platform, malware, etc.) of interest. An XCCDF benchmark's rules MAY reference one or more OVAL inventory class definitions in an OVAL component.
- An OCIL questionnaire. This questionnaire SHALL be contained in an OCIL component, which holds questionnaires that collect information that OVAL is not being used to collect, such as posing questions to users or harvesting inventory information from an existing database. An XCCDF benchmark's rules MAY reference one or more OCIL questionnaires in an OCIL component.

- o Revised legacy support requirements for SCAP content and OVAL definition documents.
- o Added an SCAP result data stream subsection. Added source and result data stream requirements throughout the section. Also added a subsection on digitally signing result data stream content.
- o Added a declaration of the FDCC Reporting Format.
- In Section 5, added malware detection material to the Inventory Scanning use case.
- Updated the normative references.
- Added Appendix C (change log).

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Digital Identity Guidelines:

3.4.4. 3.4.4). 3.4.4)
with a defined and implementable set of assurance levels and a final set of
controls for the online service.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

| Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | | Introduction | ......................................................................................................................1-1 | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope | | | | 1.3 | .................................................................................................1-1 Audience..................................................................................................................1-1 | | | | 1.4 | Document Structure.................................................................................................1-1 | | | | 1.5 | How to Navigate This Document .............................................................................1-2 | | | | Overview of Wireless Networking | ..................................................................................2-1 | | | | 2.1 | History of Wireless Networking Standards...............................................................2-1 | | | | | 2.1.1 IEEE 802.11 Standards................................................................................2-1 | | | | | 2.1.2 Wi-Fi Alliance Certification............................................................................2-2 | | | | | 2.1.3 Other Wireless Standards | ............................................................................2-3 | | | 2.2 | IEEE 802.11 Network Components and Architectural Models.................................2-4 | | | | | 2.2.1 Ad Hoc Mode................................................................................................2-4 | | | | | 2.2.2 Infrastructure Mode ......................................................................................2-6 | | | | 2.3 | Summary..................................................................................................................2-6 | | | | Overview | of IEEE 802.11 Security ..................................................................................3-1 | | | | 3.1 | WLAN Security Concerns ........................................................................................3-1 | | | | 3.2 | History of Pre-RSN IEEE 802.11 Security ...............................................................3-2 | | | | | 3.2.1 Access Control and Authentication...............................................................3-2 | | | | | 3.2.2

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.2.4, 3. 3.2.4, 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Physical Protection?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.4.2. 3.4.2.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to 2016 NIST_ITL Cybersecurity Program Annual Report:

The  CSRC  website  is  a  vast  repository  of  valuable information  relating  to  cybersecurity  research  by  NIST personnel in ITL and is one of the busiest and most expansive websites  at  NIST. CSRC  encourages  the  broad  sharing  of information security tools and practices, provides a resource for  information  security  standards  and  guidelines,  and identifies  and  links  key  security  web  resources  to  support industry  and  government  users. Several  divisions  within ITL  rely  on  the  CSRC  website  to  post  program/project

To help address information security risks, these businesses  require  assistance  with  the  identification  of security mechanisms  and  with practical, cost-effective training. Training  helps  SMB's  use  their  limited  resources most effectively to address relevant and serious threats. In response to this need, NIST, the SBA, and the FBI InfraGard program  co-sponsor  a  series  of cybersecurity training workshops for small businesses. These workshops provide an  overview  of  cybersecurity  threats,  vulnerabilities,  and corresponding protective tools and techniques, with a special emphasis on information that small business personnel can apply directly. The CMVP strengthened its relationship with the CMUF by supporting the monthly CMUF general membership meetings and five  CMUF  working  groups. The  working  groups  are  chaired by  a  member  of  industry  and/or  by  laboratory  personnel. Each working group includes a representative from the CMVP. The current working group topics include the Security Policy Template; Testing Equivalency; Revalidation in Response to Common Vulnerabilities and Exposures (CVEs); Proposed IG Integrity Testing using Random Sampling and IG Updates (IG 3.5 Documentation Requirements for Cryptographic Module Services,  IG  1.20  Sub-Chip  Cryptographic  Subsystems,  and 7.7 Key Establishment and Key Entry and Output).

2016 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series:

the block cipher using the given key. Rogaway [74] is correct to point out that the uniqueness of FIPS 81. Lipmaa et al. [51] argued for the inclusion of the CTR mode in NIST SP 800-38A and stated that 'a well-designed standard for the CTR mode should not be overly prescriptive about how [the counter blocks are] formed.' However, Rogaway does point out in Section 5.6.6 of [74] that the CTR specification may be too open-ended, which makes it more likely that an implementation of the CTR mode may be provided with a non-unique sequence of counter blocks. Rogaway then points out that compliance testing may suffer as well. Indeed, NIST's Advanced Encryption Standard Algorithm Validation Suite (AESAVS) document [12] states that 'it is not possible to implement an automated test for [the CTR] mode' and requires a manual review of the design and implementation of the CTR mode in addition to performing the automated tests for the ECB mode. one-time pad (OTP). An adversary who knows certain plaintext blocks can use the ciphertext to derive all other plaintext blocks at locations where the counter blocks are reused by means of a

Iwata et al. [43] showed that the original proof of security for GCM was flawed as well as how variable-length nonces. Consequently, some protocols such as TLS 1.3 only allow GCM with a to 'repair' it. They also showed that GCM has better security bounds for 96-bit nonces than for 96-bit nonce. Another shortcoming of GCM is that the maximum plaintext length is 2 39 -256 bits, which is about 64 GiB (gibibytes). As with CCM, the limitation is due to the underlying CTR mode: going beyond the limit leads to a complete breakdown in security, which is similar to the reuse of a one-time pad. Files of more than 64 GiB are not unusual in video editing and genomics research, but they cannot be encrypted using the GCM mode.

Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Labels for Open Systems_ an Invitational Workshop:

The Basic Security Option is required on each datagram, and if the data being transmitted falls within any of the DOE defined Categories or Handling Instructions, then an Extended Security Option is required as well. These Security Options contain orthogonal components of the security label . The Basic Security Option contains the security level and the Extended Security Option contains the security categories and handling instructions, which are collocated so that they can be treated as a single bit mask, if so desired. (In fact, a number of B1 systems currently available or under development represent security categories and compartments internally as a bit mask of 32, 64, or 128 bits. This would map well into the DOE label format and would permit a simple, efficient implementation of network security labeling.)

2 = FOUO or Sensetive but Unclassified. This leaves room on either side of this level to introduce a new hierarchical level. Since there have been several recent developments in the "sensitive but unclassified" arena, additional levels in this region are more likely than for other levels.

John Linn Secure Systems Development Digital Equipment Corporation Boxborough, MA 30 May 1990

Security Labels for Open Systems_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

| 9.6 | Step 6: Plan Testing, Training, and Exercises ..........................................................82 | Step 6: Plan Testing, Training, and Exercises ..........................................................82 | | |------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------| | 9.7 | Step 7: Plan Maintenance .........................................................................................82 | Step 7: Plan Maintenance .........................................................................................82 | | | 10.

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Representation of PIV Chain-of-Trust for Import and Export:

iction> </xs:simpleType> </xs:element> <xs:element name="DocumentTypeCode" minOccurs="1" maxOccurs="1"> <xs:simpleType> <xs:restriction base="xs:string"> <xs:enumeration value="U.S. Passport or a U.S.
Passport Card"/> <xs:enumeration value="Permanent Resident Card or an Alien Registration Receipt Card (Form I-551)"/> <xs:enumeration value="Foreign Passport"/> <xs:enumeration value="Employment Authorization Document that contains a photograph (Form I-766)"/> <xs:enumeration value="Driver's license or an ID card issued by a state or possession of
```

Representation of PIV Chain-of-Trust for Import and Export


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

3.2.3 Define/Develop Requirements

The acquirer mission/business owner or their designee, with assistance from the procurement official and other members of the SCRM team, if applicable, should define and document requirements for the procurement.

Notional Supply Chain Risk Management Practices for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to General Server Security:

| Introduction | ......................................................................................................................1-1 | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience..................................................................................................................1-2 | | | | 1.4 | Document Structure.................................................................................................1-2 | | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does CMVP Approved Authentication Mechanisms_ CMVP Validation Authority Requirements for ISO_IEC 19790 Annex E and ISO_IEC 24579 Section 6.17 provide?

[Assistant]
## NIST Special Publication 800-140E

## CMVP Approved Authentication Mechanisms:

CMVP Validation Authority Requirements for ISO/IEC 19790:2012 Annex E and ISO/IEC 24759 Section 6.17

Kim Schaffer

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-140E

I  N  F  O  R  M  A  T  I  O  N      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-140E

## CMVP Approved Authentication Mechanisms:

CMVP Validation Authority Requirements for ISO/IEC 19790 Annex E and ISO/IEC 24579 Section 6.17

Kim Schaffer Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-140E

March 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary for Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.

CMVP Approved Authentication Mechanisms_ CMVP Validation Authority Requirements for ISO_IEC 19790 Annex E and ISO_IEC 24579 Section 6.17


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to Intrusion Detection and Prevention Systems (IDPS) provide?

[Assistant]
<!-- image -->

## Guide to Intrusion Detection and Prevention Systems (IDPS)

## Recommendations of the National Institute of Standards and Technology

Karen Scarfone Peter Mell

NIST Special Publication 800-94

Guide to Intrusion Detection and Prevention Systems (IDPS)

Recommendations of the National Institute of Standards and Technology

Karen Scarfone Peter Mell

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

February 2007

<!-- image -->

## U.S. Department of Commerce

Carlos M. Gutierrez, Secretary

## Technology Administration

Robert C. Cresanti, Under Secretary of Commerce for Technology

National Institute of Standards and Technology

William Jeffrey, Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-94 Natl. Inst. Stand. Technol. Spec. Publ.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does An Introduction to Privacy Engineering and Risk Management in Federal Systems provide? (Part 3)

[Assistant]
oncepts establish the basis for a common vocabulary to facilitate better understanding and communication of privacy risk within federal systems, and the effective implementation of privacy principles.
This publication introduces two key components to support the application of privacy engineering and risk management: privacy engineering objectives and a privacy risk model. ## Keywords

Computer security; cybersecurity; information security; privacy; risk management; systems engineering

## Acknowledgements

The authors wish to thank the following individuals for participating in the preparation of this document: Jeremy Berkowitz, James Dever, Simson Garfinkel, Meredith Jankowski, and Colin Soutar. They'd also like to recognize Kelley Dempsey, Marc Groman, Mat Heyman, Kat Megas, Rebecca Richards, and Ron Ross for their role in the review process. The authors are particularly grateful to Simson Garfinkel, who was so generous with his time and thoughtful feedback. A special note of thanks goes to Kaitlin Boeckl, who developed the graphics found herein. And finally, in developing the privacy risk model, the authors greatly appreciate the insights from the pilot programs funded by NIST pursuant to the National Strategy for Trusted Identities in Cyberspace (NSTIC). ## Executive Summary

NIST research in information technology-including cybersecurity, cloud computing, big data, and the Smart Grid and other cyber-physical systems-aims to improve the innovation and competitiveness that bring great advancements to U.S. national and economic security and quality of life. Much of this research pertains to the trustworthiness of these information technologies and the systems in which they are incorporated.

An Introduction to Privacy Engineering and Risk Management in Federal Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Vulnerability Management:

3.4.3                                                                                | 3. 3.4.3 Control Item SA-11(d): DEVELOPER SECURITY TESTING AND EVALUATION

## Control Item Text

Control: The organization requires the developer of the information system, system component, or information system service to:

- d. 3.4.3 High Baseline Control Allocation Table

Table 10: High Baseline Control (Item) Allocation Table

| Determination Statement ID   | Implemented By   | Assessment Boundary   | Assessment Responsibility   | Assessment Methods   | Selected   | Rationale for Risk Acceptance   | Frequency of Assessment   | Impact of Not Implementing   |
|------------------------------|------------------|-----------------------|-----------------------------|----------------------|------------|---------------------------------|---------------------------|------------------------------|
| SI-2(1){1}                   | SWFM             | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |

| References   |                                                                                |
|--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [CNA]        | The MITRE Corporation (2019) CVE Numbering Authorities.

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Security Labels for Open Systems_ an Invitational Workshop:

Secure Systems Strategy & Planning IBM Corporation uunet!pyrdc!ibmsid!vasu (301) 240-3716


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Trustworthy Email:

�e certificate given above is an example of an end certificate . Although it claims to be signed by a wellkn own CA, anyone receiving this certificate in communication has the problem of authenticating that signature. For this, full PKIX authentication back to the root certificate is required. �e CA issues a wellknown selfsigned certificate containing its public key . �is is the root certificate . A set of current root certificates, often numbering in the hundreds of certificates , are held by individual browser developers and operating system suppliers as their set of trusted root certificates . �e process of authentication is the process of tracing the end certificate back to a root certificate, through a chain of zero or more intermediate certificates. For years, TLS has solved the problem of distributing public keys by using a certificate, signed by some wellknown Certification Authority (CA). Every browser developer and operating system supplier maintain a list of CA root certificates as trust -anchors. �ese are called the software's root certificates and are stored in the root certificate store . �e PKIX procedure allows the certificate recipient to trace a certificate back to the root . So long as the root certificate remains trustworthy, and the authentication concludes successfully, the client can proceed with the connection.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security Analysis of First Responder Mobile and Wearable Devices:

Source: NPSTC #2.7, SAFECOM 3.3.1, FirstNet 4.8.4

The officer may have unauthorized access to sensitive information that was authorized for a previous user. Additionally, accidentally collected Personally Identifiable Information (PII) may be exposed, and QPP values may be incorrectly assigned (e.g., higher priority incorrectly assigned to a lower priority user). Location data and health information may also be incorrectly associated with the previous user. The audit logs for the device or applications may be inaccurate. Availability concerns exist if the single sign-on (SSO) service goes down and the device needs to quickly be used for an emergency.

operational state. To continue their duties, the firefighter uses their personal mobile device to conduct needed tasks, including downloading and logging into public safety applications.

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to NIST Cloud Computing Forensic Science Challenges:

| EXECUTIVE SUMMARY.................................................................................................................................... VIII         | EXECUTIVE SUMMARY.................................................................................................................................... VIII         | EXECUTIVE SUMMARY.................................................................................................................................... VIII         |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| INTRODUCTION......................................................................................................................................... 2            | INTRODUCTION......................................................................................................................................... 2            | INTRODUCTION.........................................................................................................................................

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3:

3.2.1                                                                                | General... 3.2.1 General

The @xml:base attribute SHALL NOT be allowed in XCCDF content.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

| 1.1 Scope................................................................................................................
| 1                                                                                |
|                                                                                | 1.2 Related DevSecOps Initiatives.......................................................................... | 3                                                                                |
|                                                                                | 1.3 Target Audience................................................................................................ | 4                                                                                |
|                                                                                | 1.4 Relationship to Other NIST Guidance Documents............................................ | 4                                                                                |
|                                                                                | 1.5 Organization of This Document.........................................................................

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

| ID.AM-1: Physical devices and systems within the organization are inventoried ISO/IEC 27001:2013 A.8.1.1, A.8.1.2 NIST SP 800-53 Rev. 5 CM-8, PM- 5        | An inventory of physical devices should be undertaken, reviewed, and maintained to ensure these devices are not vulnerable to ransomware. It is also beneficial to have a hardware inventory during the recovery phases after a ransomware attack, should a re- installation of applications be necessary. |
| Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy. | ID.AM-2: Software platforms and applications within the organization are inventoried ISO/IEC 27001:2013 A.8.1.1, A.8.1.2 NIST SP 800-53 Rev. 5 CM-8, PM- 5 | Software inventories may track information such as software name and version, devices where it is currently installed, last patch date, and current known vulnerabilities. This information supports the remediation of vulnerabilities that could be exploited in ransomware attacks. |
| Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy. | ID.AM-3: Organizational communication and data flows are mapped ISO/IEC 27001:2013 A.13.2.1, A.13.2.2 NIST SP 800-53 Rev. 5 AC-4, CA- 3, CA-9, PL-8        | This helps to enumerate what information or processes are at risk, should the attackers move laterally within an environment.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Identification and Authentication?

[Assistant]
According to Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop:

usage) to home IoT devices may result in increased costs, design changes, or have an impact on functionality. Mark Haney gave an example of having to charge a smart watch battery daily versus weekly.
Panelist Andrew Tierney gave another example using multi-factor authentication (MFA): 'MFA represents a massive security improvement and stops password phishing. However, because consumers don't want barriers, some companies are hurt by deploying MFA. Consumers will go elsewhere.' These examples illustrate what can occur when

Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Program Review for Information Security Management Assistance (PRISMA):

Introduction .........................................................................................................................1 | |----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Purpose.......................................................................................................................1 | | | | 1.2 | Legislative Background...............................................................................................2 | | | | 1.3 | PRISMA......................................................................................................................2 | | | | 1.4 | PRISMA Assumptions and Constraints ......................................................................3 | | | | 1.5 | Audience.....................................................................................................................4 | | | | 1.6 | Document Organization | ..............................................................................................4 | | 2.

Program Review for Information Security Management Assistance (PRISMA)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

|         | 6.7.2 Restricting Cryptographic Module Entry and Output of Plaintext                                                   | Keys............................................................................................65         |
|---------|------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------|
|         | 6.7.3 Controlling Human Input.....................................................................65                   |                                                                                |
|         | 6.7.4 Multiparty Control                                                                                | ...............................................................................66                          |
|         | 6.7.5 Key Splitting                                                                                | .......................................................................................66                  |
| 6.8     | Compromise Recovery .................................................................................

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements:

3.3.1 SCAP Validation Tool' to '3. 3.3.1 SCAP Validation Tool' with '3. 3.3.1 SCAP Validation                                                                                | Tool...

Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2:

| Executive Summary................................................................................................................... 1   | Executive Summary................................................................................................................... 1   | Executive Summary................................................................................................................... 1                                                                           | Executive Summary................................................................................................................... 1   |
|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction ........................................................................................................................ | 1. Introduction ........................................................................................................................ | 1. Introduction ........................................................................................................................

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for Evaluating Differential Privacy Guarantees:

ng on its own, but as features accumulate they inevitably become uniquely identifying in combination. As a result, de-identified data nearly always contains some information that could be identifying.
For decades, it was considered prohibitively challenging to recover enough information from properly de-identified data to seriously compromise an individual's privacy [4]. However, the increasing availability of large amounts of data has led to the development of more powerful privacy attacks that disprove this assumption.

Guidelines for Evaluating Differential Privacy Guarantees


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Key Performance Indicators for Process Control System Cybersecurity Performance Analysis provide?

[Assistant]
## NISTIR 8188

## Key Performance Indicators for Process Control System Cybersecurity Performance Analysis

CheeYee Tang

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8188

<!-- image -->

## NISTIR 8188

## Key Performance Indicators for Process Control System Cybersecurity Performance Analysis

CheeYee Tang Intelligent Systems Division Engineering Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8188

August 2017

<!-- image -->

U.S. Department of Commerce Wilbur L.

Key Performance Indicators for Process Control System Cybersecurity Performance Analysis

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Security baselines are groups of settings used to configure a system to meet a target level or set of requirements or to verify that a system complies with requirements. The mSCP seeks to simplify the macOS security development cycle by reducing the amount of effort required to implement security baselines. This collaboration between federal agencies minimizes duplicate effort that would otherwise be needed for these agencies to administer individual security baselines.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators:

the DRBG mechanism. The randomness source can be an entropy source or an RBG. |
| Reseed                        | To acquire additional bits that will affect the internal state of the DRBG mechanism.
|
| Secure Channel                | A path for transferring data between two entities or components that ensures confidentiality, integrity and replay protection, as well as mutual authentication between the entities or components. The secure channel may be provided using approved cryptographic, physical or procedural methods, or a combination thereof. Sometimes called a trusted channel. |
| Security Strength             | A number associated with the amount of work (that is, the number of operations of some sort) that is required to break a cryptographic algorithm or system in some way. In this Recommendation, the security strength is specified in bits and is a specific value from the set {112, 128, 192, 256}. If the security strength associated with an algorithm or system is S bits, then it is expected that (roughly) 2 S basic operations are required to break it. |
| Seed                          | Noun : A string of bits that is used as input to a DRBG mechanism. The seed will determine a portion of the internal state of the DRBG, and its entropy must be sufficient to support the security strength of the DRBG. Verb : To acquire bits with sufficient entropy for the desired security strength. These bits will be used as input to a DRBG mechanism to determine a portion of the initial internal state. |

Recommendation for Random Number Generation Using Deterministic Random Bit Generators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Building Secure Microservices-based Applications Using Service-Mesh Architecture provide? (Part 4)

[Assistant]
The distributed cross-domain nature of microservices needs secure token service (STS), key management and encryption services for authentication and authorization, and secure communication protocols.
The ephemeral nature of clustered containers (by which microservices are implemented) calls for secure service discovery. The availability requirement calls for: (a) resiliency techniques, such as load balancing, circuit breaking, and throttling, and (b) continuous monitoring (for the health of the service). The service mesh is the best-known approach that can facilitate specification of these requirements at a level of abstraction such that it can be uniformly and consistently defined while also being effectively implemented without making changes to individual microservice code. The purpose of this document is to provide deployment guidance for proxy-based Service Mesh components that collectively form a robust security infrastructure for supporting microservices-based applications. ## Keywords

API gateway; Application Programming Interface (API); circuit breaker; load balancing; microservices; Service Mesh; service proxy. ## Acknowledgements

The authors like to express their sincere thanks to Brandon Lum, Senior Software Engineer at IBM Thomas J. Watson Research Center for his extensive, insightful feedback. They also express thanks to Isabel Van Wyk of G2-Inc and Tia Lo u den of Tetrate Inc. for their detailed editorial review. ## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Building Secure Microservices-based Applications Using Service-Mesh Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Computer Security Log Management provide? (Part 3)

[Assistant]
stitutes of Health, and the Social Security Administration, for their valuable comments and suggestions. ## Trademarks

All names are registered trademarks or trademarks of their respective companies.
## Table of Contents

| Executive Summary............................................................................................................ES-1   | Executive Summary............................................................................................................ES-1   | Executive Summary............................................................................................................ES-1                                                                    |           |
|-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|
| 1. | Introduction                                                                                | ................................................................................................................... | 1-1       |
|                                                                                | 1.1                                                                                | Authority................................................................................................................

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems:

As an emerging field, weaknesses may become evident that negate otherwise apparent advantages, or other data models may emerge with even greater benefit. Blockchain infrastructures, identity management platforms, and related user tools are still maturing, with efforts being developed to improve scalability and reliability. While the time for most readers to deploy these capabilities lies somewhere in the future, the capabilities and architecture designs discussed in this paper represent a potential new paradigm for digital identity, which could remodel or even replace traditional and federated identity management systems. Therefore, this field deserves careful consideration and scrutiny  today,  and  this  paper  is  intended  to  provide  the  foundational  tools  to  enable  such  an ongoing evaluation.

- Banking:  account  opening,  fraud  prevention,  compliance  with  anti-money  laundering (AML)  and  KYC  laws,  proof  of  funds,  credit  risk  evaluation,  as  well  as  ownership, exchange, and trading of financial assets
- Data brokerage: exchanges of datasets
- Supply chain management: asset traceability and lifecycle, networks of sensors, and the Internet of Things
- Education:  issuance  of  transcripts,  diplomas,  and  certifications  that  can  then  serve  as verifiable credentials in job applications
- Healthcare: issuance of prescriptions, submission of claims to health insurance, and sharing of health records
- Government services: issuance of driver's licenses and birth certificates, maintenance of public registries of voters
- Public safety: management of sets of equipment and reliable communication permissions
- Manufacturing: representation of ownership of 3D models
- Transportation: identification of autonomous vehicles

A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guidelines on Mobile Device Forensics provide?

[Assistant]
## NIST Special Publication 800-101 Revision 1

## Guidelines on Mobile Device Forensics

Rick Ayers Sam Brothers Wayne Jansen http://dx.doi.org/10.6028/NIST.SP.800-101r1

<!-- image -->

## NIST Special Publication 800-101 Revision 1

## Guidelines on Mobile Device Forensics

Rick Ayers Software and Systems Division Information Technology Laboratory

Sam Brothers U.S. Customs and Border Protection Department of Homeland Security Springfield, VA

Wayne Jansen Booz Allen Hamilton McLean, VA

http://dx.doi.org/10.6028/NIST.SP. 800-101r1

May 2014

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 et seq., Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment:

3.1.1 ISCM Program Assessment Plan... 3.1.1 ISCM Program Assessment Plan... 3.1.1 ISCM Program Assessment Plan

The ISCM Program Assessment Plan guides the execution of the ISCM program assessment.

Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Trustworthy Email provide? (Part 5)

[Assistant]
anization. For most of this document, it will be assumed that the organization has some or all responsibility for email and can configure or manage its own email and Domain Name System (DNS) systems .
Even if this is not the case, the guidelines and recommendations in this document may help in education about email security and can be used to produce a set of requirements for a contracted service. ## Trademark Information

All registered trademarks belong to their respective organizations. ## Executive Summary

�is document gives recommendations and guidelines for enhancing trust in email . �e primary audience includes enterprise email administrators, information security specialists and network managers. �is guideline applies to federal IT systems and will also be useful for small or medium sized organizations. Email is a core application of computer networking and has been such since the early days of Internet development. In those early days, networking was a collegial, research -oriented enterprise. Security was not a consideration. �e past forty years have seen diversity in applications deployed on the Internet, and worldwide adoption of email by research organizations, governments, militaries, businesses and individuals. At the same time there has been an associated increase in (Internet-based) criminal and nuisance threats. �e Internet's underlying core email protocol, Simple Mail Transport Protocol (SMTP), was first adopted in 1982 and is still deployed and operated today. However, this protocol is susceptible to a wide range of attacks including man -in-themiddle content modification and content surveillance. �e basic standards have been modified and augmented over the years with adaptations that mitigate some of these threats. With spoofing protection, integrity protection, encryption and authentication, properly implemented email systems can be regarded as sufficiently secure for governme nt, financial and medical communications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT):

| Objects | Information Resources | Information Resources | Systems | Intelligent Computing Services | |---------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | • Home telehealth • Medical devices • Health and wellness products | • HL7 Fast Healthcare Interoperability Resource (FHIR) • Structural and semantic standards (vocabularies, code and value sets) • Actuators that receive commands • Personally worn physiological sensors | • HL7 Fast Healthcare Interoperability Resource (FHIR) • Structural and semantic standards (vocabularies, code and value sets) • Actuators that receive commands • Personally worn physiological sensors | • Payment • Research (system of systems) • Personal health records • Treatment o Electronic health records o Monitoring | • Learning Health System o Big data o High performance computing o Knowledge access o Natural language processing o Transformation o Longitudinal monitoring of patient progress o Adverse event monitoring o Translation | | People | People | People | People | People | | • Patients o Patient representatives o Health conscious individuals | • Patients o Patient representatives o Health conscious individuals | • Licensed Healthcare Providers: o Audiologists, o Dentists o Dietitians o Optometrists o Physicians o Nurses o Technicians/ Technologists | Therapists |  Non-Licensed Healthcare Providers: o Administrative personnel o

Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

There have been several well-publicized regional Internet outages that have been the result of denial of service attacks, viruses infiltrating web servers, worms taking down DNS servers, failures in undersea cables, and fiber optic cables being damaged during earthquakes and subsequent mudslides. Although these outages are relatively infrequent, they can have an impact on network connectivity for hours. Contingency planning for these rare but often serious outages should be addressed as part of any organization's tactical IT plans. Most substantial applications are using the Internet today regardless of whether cloud computing is employed; therefore the reader should not assume that by avoiding a cloud a user automatically avoids risks associated with Internet outages. Thus clarity as to how to divide the roles and responsibilities of implementing security controls is important to help organizations: (1) define detailed security plans to address cloud security requirements, (2) develop or procure appropriate security measures during development, (3) objectively compare and evaluate providers, and (4) execute security protocols during the deployment and throughout operation. In addition, collaboration between providers and consumers can help ensure that clouds meet specific security conformance and regulatory requirements, especially for those supporting government agency operations.

Cloud Computing Synopsis and Recommendations